Independent assessment practice / Entra workload & non-human identity
A written record of what your tenant is actually configured to do.
Kino Security is an independent security assessment practice. The specialty is Entra workload and non-human identity: service principals, enterprise applications, application permissions, OAuth consent grants, and the credentials and governance around them. A non-human identity assessment examines what these identities can reach, who owns them, and whether that access is still justified. Engagements are fixed scope: the environment is examined, a written report is delivered, and the engagement ends. Nothing is sold afterward — no products, no managed service.
- Evidence-led
- Direct assessor access
01
Deliverable
The deliverable
Every engagement ends in a single written report: what was examined, what was found, the evidence behind each finding, and what to change. Evidence is included so findings can be verified independently, not taken on trust. The severity language is fixed in advance, and the report states its own coverage limits.
See the report taken apart02
Examination
What gets examined
Scope is agreed in writing before any access is granted. The center of the work is Entra workload and non-human identity — the first group below. The broader tenant surfaces follow, because human and workload identity fail together.
Enterprise apps and service principals
servicePrincipals
Which workloads and integrations hold identities in the tenant, what they can reach, and whether their ownership and purpose are still clear.
Application credential expiry (secrets and certificates)
applications?
Which workload credentials are expired or approaching expiry, and whether secrets and certificates are governed with a deliberate rotation window.
OAuth consent grants and delegated permissions
oauth2PermissionGrants
Which applications have delegated access, at what scopes, and whether each consent remains necessary and proportionate.
Privileged roles and PIM eligibility
roleManagement/directory/
Who holds tenant-wide administrative capability, and whether that access is standing or activated on demand.
Conditional Access policy set
identity/conditionalAccess/policies
Which sign-ins are actually governed, which are excluded, and what the exclusions add up to in practice.
Authentication methods and MFA coverage
reports/authenticationMethods/
What each identity is able to authenticate with, and where weaker methods remain available.
Exchange Online transport and mailbox rules
Get-TransportRule / Get-InboxRule
Exchange Online PowerShell
Where mail is forwarded, redirected, or silently moved, and which rules nobody remembers creating.
SharePoint and OneDrive external sharing
Get-SPOTenant / Get-SPOSite
SharePoint Online Management Shell
What may be shared outside the organization, by whom, and what already has been.
Intune compliance and configuration profiles
deviceManagement/
What a device must satisfy before it is trusted, and whether the assigned policy set says what it is assumed to say.
Defender and Secure Score posture
security/secureScores
Which controls are reported as in place, and whether the reported state matches the configured state.
Read-only throughout — nothing is changed. A focused engagement may cover a subset; the agreed scope governs. Findings reference the CIS Microsoft 365 Benchmark, CISA SCuBA, and NIST CSF 2.0 where they apply.
03
Services
Assessment services
The specialty is Entra workload and non-human identity. Beyond it: HIPAA Security Rule risk analysis, Microsoft 365 and Entra tenant assessment, endpoint and Intune review, detection coverage, AI use policy, vulnerability assessment, and posture assessment against NIST CSF 2.0 or CIS Controls. Scope and a fixed fee are agreed in writing before access is granted. The services page lists each engagement.
- Work
- Fixed-scope security assessment of an agreed environment, control set, or security question.
- Access
- Temporary, read-only, and limited to what the assessment requires.
- Deliverable
- A written assessment report with evidence, impact analysis, and specific remediation guidance.
- Outside the model
- Ongoing administration, managed security operations, remediation, and standing access. The client pays for the assessment and the judgment behind it — nothing else.
Subcontract engagements: Kino works with security firms as a named or white-label assessor under the firm's client agreement — NDA first, and the report is delivered in your format or Kino's. The same scope, evidence, and data-handling terms apply.
04
Method
Conduct of an engagement
The process is straightforward: define the question, examine the evidence, document the result, and close the access used for the assessment. Tool output is the starting point, not the assessment — the work is in the exclusions, the exceptions, and the judgment about which findings are load-bearing.
-
Scope
Objectives, systems, exclusions, access requirements, and expected delivery are agreed in writing before assessment work begins.
-
Access
Temporary read-only access is established for the agreed assessment window and limited to what the scope requires.
-
Assessment
Configuration, identity, relevant documentation, and other agreed evidence are reviewed. Potential findings are validated and analyzed for practical impact.
-
Report
Findings are documented with evidence, impact analysis, remediation guidance, and an executive summary that identifies the material conclusions.
-
Delivery & closeout
The material findings and priorities are reviewed with the client. The report is issued, and assessment access is removed.
Data handling
An assessment produces evidence about weaknesses. How that evidence is held is part of the engagement, not an afterthought.
- Agreement
- A mutual non-disclosure agreement is executed before scoping details are exchanged.
- Access
- Provisioned by the client, read-only, scoped to the assessment, and time-boxed to the agreed window.
- Evidence
- Collected read-only and held encrypted. Used for the assessment and for nothing else.
- Identifiers
- Principal, tenant, and account identifiers are truncated in the report wherever the full value is not required to act on the finding.
- Retention
- Working evidence is destroyed at closeout. The client retains the report and the evidence within it.
- Closeout
- Assessment access is removed at delivery, and the removal is confirmed in writing.
- Disclosure
- Findings are not published, reused, or referenced as marketing. No client is named without written permission.
05
About
The assessor
Every Kino Security engagement is delivered by Robert Jaworski, an independent security assessor. The same person scopes the work, examines the environment, and writes the report — the findings in the document are the findings that were found, not findings passed down a delivery chain.
The practice is grounded in more than a decade of systems and security administration in HIPAA-regulated healthcare and human services environments, with direct operating responsibility for Microsoft 365, Entra, Intune, and security governance.
That operating context informs how configuration, access, and control failures are evaluated: as conditions someone must understand, prioritize, and remediate — not as scores to collect.
- Assessor
- Robert Jaworski
- Background
- More than a decade of systems and security administration
- Operating context
- Microsoft cloud administration and security governance in HIPAA-regulated healthcare and human services
- Technical emphasis
- Cloud identity, privileged access, endpoint management, and non-human identities
- Credentials
- B.S. Cybersecurity & Information Assurance; ISC² SSCP; CompTIA CySA+; CompTIA PenTest+
06
Contact
Contact
Send a short note about the environment, what you would like examined, and any timing constraint.
No system access is needed to start the conversation. Currently accepting new engagements; replies within two business days, Eastern time. If the work fits the practice, Kino will define the scope, fee, access requirements, and expected delivery before assessment work begins.
Assessment inquiriesinfo@kinosecurity.com
Helpful context
Organization or environment, what you want reviewed, approximate scope, and desired timing. A formal statement of work is not needed for the first note.